Container-managed EIS signon
With container-managed EIS signon, the security manager in the application server manages the security information for your application.
When the directive <res-auth>Container</res-auth> is specified in the deployment descriptor of the application, container-managed EIS signon is used. In this case, the application server (the container) provides the security information (user ID and password).
For TCP/IP, the application server passes the security information in the alias to the IMS™ TM resource adapter. The IMS TM resource adapter passes the security information to IMS Connect for authentication. IMS Connect authenticates the user and passes the security information for signon to IMS. If IMS Connect cannot authenticate the user, a security failure is returned to the IMS TM resource adapter which, in turn, passes an exception back to the application.
For Local Option, a z/OS-only feature in which both the server and WebSphere® Application Server are running in the same z/OS® image, the application server authenticates the user based on the security information that is defined in the container-managed alias. The application server creates and passes a user token that represents the authenticated user to the IMS TM resource adapter. The IMS TM resource adapter then passes the user token to IMS Connect which, in turn, passes it to IMS OTMA for use in signing on to IMS.
Alternatively, when using Local Option communications, you can specify in the application server configuration that the user identity that is associated with the current thread of execution is to be used by the application server during user authentication. In this case, you do not specify a JAAS container-managed authentication alias in the J2C connection factory that is used by your application. This option is available only if you are using Local Option communications.
With container-managed signon, if your application does pass security information to the IMS TM resource adapter by using the userName, password or groupName properties of the IMSConnectionSpec class, this information is ignored. However, if you pass other information in the IMSConnectionSpec object, such as the client ID with commit mode 0 interactions, this information is used by the IMS TM resource adapter.